Dashboards & Visualizations

How do I set drilldown if I want to set several pages to go?

appleman
Contributor

Hello there,

I want to set drilldown on the dashboard attached below, but how can I set if I want to set several token?
Here is what I want to do;
If you click the column "InstallProfile" under command, it goes to the page which its search is "source=xxx".
Or if you click the column "EnrollDevice", it goes to another page which its search is "source=yyy".

Please give me some advice.

Thank you.


添付のテーブル上で、"InstallProfile"をクリックすると、"source=xxx"が設定されているページに遷移し、他のコマンド、(例:"EnrollDevice")をクリックすると、今度は"source=yyy"というページに遷移するようにドリルダウンを設定したい場合、どのように設定したらよいのでしょうか。

alt text

0 Karma
1 Solution

gauldridge
Path Finder

One way I have solved a similar problem in the past is to have a generic form search view that is the target of a drilldown. For example, the Simple XML for the dashboard panel you showed could include the following:

<drilldown target="_blank">
  <link>
    /app/{appname_here}/generic_landing_view?form.incomingToken=$row.command$
  </link>
</drilldown>

In the <fieldset> section of the target page, make sure to include:

<input type="text" token="incomingToken" />

Then your search string would be:

source=[| gentimes start=-1 | eval value="$incomingToken$" | eval value=case(value=="InstallProfile","xxx",value=="EnrollDevice","yyy") | fields value | rename value AS search]

You can make the case statement as large and complicated as need be to take all your possible values into account.

View solution in original post

gauldridge
Path Finder

One way I have solved a similar problem in the past is to have a generic form search view that is the target of a drilldown. For example, the Simple XML for the dashboard panel you showed could include the following:

<drilldown target="_blank">
  <link>
    /app/{appname_here}/generic_landing_view?form.incomingToken=$row.command$
  </link>
</drilldown>

In the <fieldset> section of the target page, make sure to include:

<input type="text" token="incomingToken" />

Then your search string would be:

source=[| gentimes start=-1 | eval value="$incomingToken$" | eval value=case(value=="InstallProfile","xxx",value=="EnrollDevice","yyy") | fields value | rename value AS search]

You can make the case statement as large and complicated as need be to take all your possible values into account.

appleman
Contributor

Thank you! Your query helped me a lot!

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...